Actively exploited Cisco 0day with maximum severity gives full network control

arstechnica.com

128 points·AdmiralAsshat··7 comments

> It should go without saying, but the HTTP and HTTPS server feature should never be enabled on Internet-facing systems as is consistent with long-established best practices. Cisco reiterated the guidance in Monday’s advisory.

I mean a 0day is always bad, specially a high severity one but this was the first thing I though, why was it accessable from the public internet.

All critical hardware's management plane should only be accessible from a hardened jump box.

Yeah, I would like Cisco not to ship software this easily compromised but in this case I don’t think it’d be unwarranted to contact the victims’ CEOs and say their network team is incompetent. Not leaving this stuff exposed to the internet is an entry-level skill.

I don't think I've ever met a Cisco IOS admin who configured via the web interface that I would allow to touch production networks, and certainly not anything internet facing.

It's interesting how when I see a headline like this one my first response is 'oh, I already saw that' and then I realize that it's Cisco and it may well be another one even though the previous one is only a very short while ago.

A Cisco 0-day isn't really news, is it?

You better do your STIGs

https://stigviewer.com/stig/cisco_ios_xe_switch_l2s/2020-05-... https://stigviewer.com/stig/cisco_ios_xe_router_rtr/2020-09-...

All we know is, he's called the Stig.

Reply on news.ycombinator.com